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Dear Data Sharing Code team, 


Many apologies that this email comes after the close of your consultation deadline, | hope it is 
okay that | am emailing you with this now. 


The Royal Academy of Engineering recently published Towards trusted data sharing: guidance 
and case studies, which may be of interest in relation to your draft data sharing code of practice. 


The publication is aimed at organisations that have identified the opportunity to create value 
through sharing data and are considering setting up arrangements for data sharing. It explores 
the key enablers and constraints, including governance, business models, technologies and 
regulation. A data sharing checklist guides organisations through the main areas for 
consideration as they work towards a data-sharing solution, including consideration of whether 
the data-sharing opportunity is legal and how the nature of the data and its use affect the 
principles around data is shared. 


The case studies highlight the many benefits of sharing data for society, organisations and 
individuals. The case studies cover a range of data-sharing activities across public and private 
sectors, and include examples with both personal and non-personal data. Although not falling 
under the data protection act, non-personal data may be sensitive for commercial or national 
security reasons, and similar principles around privacy and security, and controlling access to and 
use of data, are likely to apply. 


Findings from the report that may be of interest include the following: 

e The report finds that the development of robust and trustworthy frameworks for 
sharing data are key to making data sharing practices more acceptable to organisations 
and the public, and we therefore welcome the ICO’s draft data sharing code of practice. 

e = |ndeed, the effort required to share data often reflects an imperfect context in which 
data sharing occurs; frameworks and guidance, among other aspects, will help in 
decreasing the friction involved in data sharing. 

e Mechanisms go beyond securing data-sharing agreements and include: 

o Technologies and architectures that facilitate security or privacy 

o Robust processes for checking quality 

o Mechanisms for ensuring the various parties are compliant with terms and 
conditions 

o Ensuring various parties have the skills and resources to deliver their parts of the 
agreement 

o Auser-centric approach, with easy-to-understand tools and policies. 

e = Acentral hub or trusted intermediary can facilitate trusted sharing, but it needs its own 
business model and governance framework to be sustainable and underpin trust. 

e Data must be assembled, structured and managed over its lifecycle so that it meets 
privacy or business requirements, for which a robust engineering approach is needed. 
Data sharing may be just a small, but potentially significant, part of the requirements and 
its success relies on the engineering being done well. 


e = It will be vital to ensure that data is being managed in line with data-sharing agreements 
between parties exchanging and using the data. Commitments to manage and use data 
appropriately may extend over many years. This is even more important where tensions 
exist, for example, between the need for an organisation to meet its own aims and the 
need to maintain privacy or other regulatory or legal requirements. 


| would be happy to discuss further if useful, 
Best wishes 
Royal Academy of Engineering 


Wwww.raeng.org.uk 


Find us on Facebook, LinkedIn, or follow @RAEngNews on Iwitter for the latest updates. 
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